Description

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-09T06:18:34.330Z",
  "pubdate": "2026-08-09T06:18:34.330Z",
  "executiveSummary": "The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 suffers from an authorization bypass and missing cryptographic nonce verification vulnerability within its reporting functionality.\nThis security defect allows unauthenticated remote threat actors to query the application and unlawfully retrieve sensitive e-commerce transaction data.\nThe impacted product is the WPC Order Tip for WooCommerce plugin across all versions prior to 3.3.1.\nThe resulting impact is a severe breach of confidentiality, exposing personally identifiable information and financial metadata belonging to store customers, including customer billing names, internal order IDs, current order statuses, applied fee amounts, and precise order creation dates.\nBecause the vulnerability requires no authentication, prior privileges, or complex interaction, any external attacker possessing network access to the target WordPress instance can execute automated enumeration scripts to harvest customer data at scale.\nThis introduces significant risk implications regarding data privacy regulations, brand reputation, and potential downstream targeted phishing or social engineering campaigns against affected customers.\nRemediation requires updating the affected plugin to version 3.3.1 or later.",
  "technicalDetails": "The root cause of this vulnerability lies in the complete absence of proper access control checks and cryptographic nonce validation within a specific reporting feature exposed by the WPC Order Tip for WooCommerce plugin.\nIn secure WordPress plugin architectures, AJAX endpoints, REST API routes, and admin-ajax handlers must verify user session contexts using capability checks (such as current_user_can) alongside cryptographic nonce verification to ensure requests originate from legitimate, authorized interfaces.\nIn versions prior to 3.3.1 of the WPC Order Tip for WooCommerce plugin, the reporting component fails to validate whether the incoming HTTP request is initiated by an authenticated user with administrative or shop manager privileges.\nFurthermore, the endpoint does not require or validate a nonce parameter, neutralizing standard CSRF and direct request protections.\nThe attack flow begins when an unauthenticated attacker sends a crafted HTTP request directly to the vulnerable reporting endpoint or AJAX handler exposed by the plugin over the public network.\nUpon receiving the unvalidated request, the vulnerable component processes the query without performing any identity verification or authorization checks.\nThe backend subsequently queries the underlying database or session context and compiles the requested reporting data.\nThe payload behavior involves returning the harvested sensitive order data directly within the HTTP response body, usually formatted as JSON or HTML.\nThe post-exploitation impact includes the mass extraction of sensitive customer information, specifically exposing billing names, internal order identifiers, transaction statuses, fee values, and order dates for any customer registered within the WooCommerce store.\nThe vulnerability is exploitable remotely over the network with zero authentication requirements and zero privilege prerequisites, making it a critical threat vector for automated data harvesting."
}